aws-runtime-bridge 1.9.70 → 1.9.72

package/dist/services/runtime-lifecycle-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-lifecycle-policy.d.ts","sourceRoot":"","sources":["../../src/services/runtime-lifecycle-policy.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0BAA0B,EAAE,OAAO,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,gBAAgB,EAAE,OAAO,GACxB,oBAAoB,CAUtB;AAED;;;;GAIG;AACH,wBAAgB,uCAAuC,CACrD,gBAAgB,EAAE,OAAO,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET"}
+{"version":3,"file":"runtime-lifecycle-policy.d.ts","sourceRoot":"","sources":["../../src/services/runtime-lifecycle-policy.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,oBAAoB,EAAE,OAAO,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0BAA0B,EAAE,OAAO,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sBAAsB,EAAE,OAAO,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,gBAAgB,EAAE,OAAO,GACxB,oBAAoB,CAWtB;AAED;;;;GAIG;AACH,wBAAgB,uCAAuC,CACrD,gBAAgB,EAAE,OAAO,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAET"}

package/dist/services/runtime-lifecycle-policy.js

@@ -11,6 +11,7 @@ export function buildGracefulShutdownPlan(preserveSessions) {
         terminateResidualProcesses: shouldCleanRuntimeState,
         unregisterInstance: shouldCleanRuntimeState,
         clearPersistedSessions: shouldCleanRuntimeState,
+        stopTunnelClient: shouldCleanRuntimeState,
     };
 }
 /**

package/dist/services/session-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-output.d.ts","sourceRoot":"","sources":["../../src/services/session-output.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAc,EAAE,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AAKlD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAK3C,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAK1F;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAI3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,4BAA4B;AAC5B,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,gCAA2C,CAAC;AAI1E,UAAU,uBAAuB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA6ED,aAAa;AACb,eAAO,MAAM,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAa,CAAC;AAExD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,uBAAuB,EACpC,KAAK,CAAC,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,EACD,WAAW,CAAC,EAAE,0BAA0B,EACxC,SAAS,CAAC,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,CAiJ7C;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,qBAAqB,EAChC,WAAW,CAAC,EAAE,0BAA0B,EACxC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAuHf;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,OAAO,EAAE,EACpB,WAAW,CAAC,EAAE,0BAA0B,EACxC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CA6Cf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBzE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAa3D;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCzE"}
+{"version":3,"file":"session-output.d.ts","sourceRoot":"","sources":["../../src/services/session-output.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAc,EAAE,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AAKlD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAK3C,OAAO,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAK1F;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAI3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,4BAA4B;AAC5B,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,gCAA2C,CAAC;AAI1E,UAAU,uBAAuB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA+FD,aAAa;AACb,eAAO,MAAM,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAa,CAAC;AAExD;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,uBAAuB,EACpC,KAAK,CAAC,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,EACD,WAAW,CAAC,EAAE,0BAA0B,EACxC,SAAS,CAAC,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,CAiJ7C;AAED;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,qBAAqB,EAChC,WAAW,CAAC,EAAE,0BAA0B,EACxC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAuHf;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,OAAO,EAAE,EACpB,WAAW,CAAC,EAAE,0BAA0B,EACxC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CA6Cf;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBzE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAa3D;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCzE"}

package/dist/services/session-output.js

@@ -20,10 +20,25 @@ import { getRuntimeAccessToken } from "./runtime-binding.js";
 export const bridgeEventBuffer = new RingBuffer(2000);
 function runtimeAuthHeaders(options, callbackBaseUrl = resolveRuntimeCallbackBaseUrl(options)) {
     const token = options?.runtimeAccessToken ||
-        getRuntimeAccessToken(undefined, callbackBaseUrl) ||
+        getRuntimeAccessToken(callbackBaseUrl) ||
         getRuntimeAccessToken();
     return token ? { "X-Runtime-Token": token } : undefined;
 }
+/**
+ * 构造重试鉴权选项：丢弃 session pinning 的 runtimeAccessToken，仅保留 schedulerBaseUrl。
+ *
+ * 401 触发 tryRefreshRuntimeToken 后，scoped store 已写入刷新后的新实例 token。
+ * 但常规调用传入的 authOptions.runtimeAccessToken 是启动时 pinning 的 per-launch token，
+ * 若该 token 已被 server 端 revoke/rotate，retry 仍用它会持续 401（runtimeAuthHeaders 优先
+ * options.runtimeAccessToken）。丢弃后 runtimeAuthHeaders 会回退到 getRuntimeAccessToken
+ * 读取刷新后的实例 token，使重试有机会成功。
+ */
+function retryAuthOptions(options) {
+    if (!options) {
+        return undefined;
+    }
+    return { schedulerBaseUrl: options.schedulerBaseUrl };
+}
 /**
  * 解析 Runtime 回调的调度中心地址。
  * 主流程：优先使用启动请求携带的 scheduler 地址；否则按环境变量、单自动注册目标、默认值依次回退。
@@ -176,7 +191,7 @@ export async function sendStatus(agentId, sessionId, status, actionInfo, usage,
         if (getAxiosStatusCode(error) === 401) {
             const refreshed = await tryRefreshRuntimeToken(callbackBaseUrl);
             if (refreshed) {
-                const retryHeaders = runtimeAuthHeaders(authOptions, callbackBaseUrl);
+                const retryHeaders = runtimeAuthHeaders(retryAuthOptions(authOptions), callbackBaseUrl);
                 if (retryHeaders) {
                     try {
                         const retryResponse = await axios.post(`${callbackBaseUrl}/api/runtime/callback/status`, payload, { headers: retryHeaders, timeout: 15000 });
@@ -272,7 +287,7 @@ export async function sendOutput(agentId, output, sessionId, seq, metadata, auth
         if (getAxiosStatusCode(error) === 401) {
             const refreshed = await tryRefreshRuntimeToken(callbackBaseUrl);
             if (refreshed) {
-                const retryHeaders = runtimeAuthHeaders(authOptions, callbackBaseUrl);
+                const retryHeaders = runtimeAuthHeaders(retryAuthOptions(authOptions), callbackBaseUrl);
                 if (retryHeaders) {
                     try {
                         const retryConfig = {
@@ -374,7 +389,7 @@ export async function sendQuestionRequest(agentId, sessionId, questions, authOpt
         if (getAxiosStatusCode(error) === 401) {
             const refreshed = await tryRefreshRuntimeToken(callbackBaseUrl);
             if (refreshed) {
-                const retryHeaders = runtimeAuthHeaders(authOptions, callbackBaseUrl);
+                const retryHeaders = runtimeAuthHeaders(retryAuthOptions(authOptions), callbackBaseUrl);
                 if (retryHeaders) {
                     try {
                         await axios.post(`${callbackBaseUrl}/api/runtime/callback/question`, payload, { headers: retryHeaders });

package/dist/services/tunnel-client.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Bridge 反向隧道客户端
+ *
+ * 当 bridge 位于 NAT/内网（无公网），server 有公网时：bridge 注册虚拟隧道地址
+ *（形如 http(s)://server/tunnel/{instanceId}），注册成功后通过本客户端主动连出到
+ * server 的 /ws/bridge-tunnel，server 对 bridge 的 HTTP/WebSocket 调用均经此隧道转发。
+ *
+ * 多 server 支持：autoRegisterTargets 配置多个 server 时，每个 server 注册成功后
+ * 各自建立一条独立隧道，按归一化 serverUrl 为 key 并存于 tunnels Map，互不干扰；
+ * 同一 server 重复注册（重试/token 轮换）时先拆旧隧道再以最新 instanceId 重建。
+ *
+ * 协议帧格式见 BridgeTunnelService（server 端）。
+ */
+/**
+ * 启动（或重启）到指定 server 的隧道。
+ * 同一 serverUrl 已存在隧道时先拆旧重建，不同 serverUrl 的隧道并存。
+ */
+export declare function startTunnelClient(serverUrl: string, instanceId: string): void;
+/** 停止全部隧道（graceful shutdown 用） */
+export declare function stopTunnelClient(): void;
+//# sourceMappingURL=tunnel-client.d.ts.map

package/dist/services/tunnel-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-client.d.ts","sourceRoot":"","sources":["../../src/services/tunnel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgGH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAuB7E;AAED,kCAAkC;AAClC,wBAAgB,gBAAgB,IAAI,IAAI,CAMvC"}

package/dist/services/tunnel-client.js

@@ -0,0 +1,402 @@
+/**
+ * Bridge 反向隧道客户端
+ *
+ * 当 bridge 位于 NAT/内网（无公网），server 有公网时：bridge 注册虚拟隧道地址
+ *（形如 http(s)://server/tunnel/{instanceId}），注册成功后通过本客户端主动连出到
+ * server 的 /ws/bridge-tunnel，server 对 bridge 的 HTTP/WebSocket 调用均经此隧道转发。
+ *
+ * 多 server 支持：autoRegisterTargets 配置多个 server 时，每个 server 注册成功后
+ * 各自建立一条独立隧道，按归一化 serverUrl 为 key 并存于 tunnels Map，互不干扰；
+ * 同一 server 重复注册（重试/token 轮换）时先拆旧隧道再以最新 instanceId 重建。
+ *
+ * 协议帧格式见 BridgeTunnelService（server 端）。
+ */
+import axios, { AxiosError } from "axios";
+import WebSocket from "ws";
+import { getRuntimeAccessToken, normalizeSchedulerBaseUrl, } from "./runtime-binding.js";
+import { loadConfigs, loadPrimaryLifecycleConfig } from "./auto-register.js";
+import { logger } from "../utils/logger.js";
+import { port } from "../config.js";
+const PING_INTERVAL_MS = 15_000;
+const RECONNECT_DELAY_MS = 5_000;
+/** 本地 WS open 前的消息排队上限，防止异常情况下队列无限增长 */
+const MAX_PENDING_WS_MESSAGES = 200;
+/** server 端鉴权失败的关闭码（见 BridgeTunnelWebSocketHandler.CLOSE_AUTH_FAILED） */
+const CLOSE_CODE_AUTH_FAILED = 4001;
+/** 活跃隧道：key = 归一化 serverUrl，value = 该 server 的独立隧道状态 */
+const tunnels = new Map();
+function resolveTunnelEndpoint(state) {
+    const targetUrl = state.serverUrl;
+    const instanceId = state.instanceId;
+    if (!targetUrl || !instanceId) {
+        return null;
+    }
+    try {
+        const base = new URL(targetUrl);
+        const wsProto = base.protocol === "https:" ? "wss:" : "ws:";
+        const scopedToken = getRuntimeAccessToken(targetUrl);
+        // userKey 回退必须按触发注册的 server 匹配，避免多 target 时错用第一个 target 的凭据
+        const matchedConfig = loadConfigs().find((item) => normalizeSchedulerBaseUrl(item.serverUrl) === targetUrl) || loadPrimaryLifecycleConfig();
+        const runtimeAccessToken = scopedToken || matchedConfig.userKey;
+        if (scopedToken) {
+            logger.debug("[TunnelClient] 使用 runtime access token 连接隧道");
+        }
+        else if (matchedConfig.userKey) {
+            logger.warn("[TunnelClient] getRuntimeAccessToken 返回空，回退到 userKey（非 runtime token，鉴权可能失败）: targetUrl=", targetUrl);
+        }
+        if (!runtimeAccessToken) {
+            logger.warn("[TunnelClient] 缺少 runtime token，无法建立隧道: targetUrl=", targetUrl);
+            return null;
+        }
+        // token 走 X-Runtime-Token 握手头，不进 URL，避免写入 server access log
+        const query = new URLSearchParams({ instanceId });
+        return {
+            url: `${wsProto}//${base.host}/ws/bridge-tunnel?${query.toString()}`,
+            token: runtimeAccessToken,
+        };
+    }
+    catch (e) {
+        logger.warn("[TunnelClient] 无法解析 serverUrl:", String(e));
+        return null;
+    }
+}
+/**
+ * 启动（或重启）到指定 server 的隧道。
+ * 同一 serverUrl 已存在隧道时先拆旧重建，不同 serverUrl 的隧道并存。
+ */
+export function startTunnelClient(serverUrl, instanceId) {
+    const normalized = normalizeSchedulerBaseUrl(serverUrl);
+    if (!normalized) {
+        logger.warn("[TunnelClient] serverUrl 无效，无法启动隧道:", serverUrl);
+        return;
+    }
+    // 同一 server 已有隧道：先拆掉，避免重复注册导致同 server 多连接并存、
+    // 旧连接的 close 回调误清掉新连接的本地流
+    const existing = tunnels.get(normalized);
+    if (existing) {
+        existing.shuttingDown = true;
+        teardownConnection(existing);
+        tunnels.delete(normalized);
+    }
+    const state = {
+        serverUrl: normalized,
+        instanceId,
+        streams: new Map(),
+        shuttingDown: false,
+    };
+    tunnels.set(normalized, state);
+    connect(state);
+}
+/** 停止全部隧道（graceful shutdown 用） */
+export function stopTunnelClient() {
+    for (const state of tunnels.values()) {
+        state.shuttingDown = true;
+        teardownConnection(state);
+    }
+    tunnels.clear();
+}
+/**
+ * 拆除指定隧道连接：清定时器、关闭全部本地流、关闭隧道 WS。
+ * 关闭前移除隧道 WS 的事件监听，防止其 close/error 回调再次触发
+ * cleanup/scheduleReconnect 干扰后续新连接。
+ */
+function teardownConnection(state) {
+    if (state.timer) {
+        clearInterval(state.timer);
+        state.timer = undefined;
+    }
+    if (state.reconnectTimer) {
+        clearTimeout(state.reconnectTimer);
+        state.reconnectTimer = undefined;
+    }
+    for (const [id, stream] of state.streams.entries()) {
+        try {
+            stream.ws.close(1000, "tunnel client stopped");
+        }
+        catch {
+            // ignore
+        }
+        state.streams.delete(id);
+    }
+    if (state.ws) {
+        state.ws.removeAllListeners();
+        try {
+            state.ws.close(1000, "tunnel client stopped");
+        }
+        catch {
+            // ignore
+        }
+        state.ws = undefined;
+    }
+}
+function connect(state) {
+    if (state.shuttingDown)
+        return;
+    const instanceId = state.instanceId;
+    if (!instanceId) {
+        return;
+    }
+    const endpoint = resolveTunnelEndpoint(state);
+    if (!endpoint) {
+        scheduleReconnect(state);
+        return;
+    }
+    logger.info("[TunnelClient] 连接隧道服务端:", endpoint.url);
+    const ws = new WebSocket(endpoint.url, {
+        handshakeTimeout: 15_000,
+        headers: { "X-Runtime-Token": endpoint.token },
+    });
+    state.ws = ws;
+    ws.on("open", () => {
+        logger.info("[TunnelClient] 隧道连接已建立: server=", state.serverUrl, "instanceId=", instanceId);
+        state.reconnectTimer && clearTimeout(state.reconnectTimer);
+        state.reconnectTimer = undefined;
+        state.timer = setInterval(() => {
+            if (ws.readyState === WebSocket.OPEN) {
+                ws.send(JSON.stringify({ t: "ping" }));
+            }
+        }, PING_INTERVAL_MS);
+    });
+    ws.on("unexpected-response", (req, res) => {
+        logger.error("[TunnelClient] 服务端拒绝连接（非 101 响应）: server=", state.serverUrl, "statusCode=", res.statusCode, "statusMessage=", res.statusMessage);
+    });
+    ws.on("upgrade", (res) => {
+        logger.debug("[TunnelClient] 收到升级响应: statusCode=", res.statusCode);
+    });
+    ws.on("message", (raw) => {
+        let text;
+        if (typeof raw === "string") {
+            text = raw;
+        }
+        else if (Buffer.isBuffer(raw)) {
+            text = raw.toString("utf-8");
+        }
+        else {
+            text = Buffer.from(raw).toString("utf-8");
+        }
+        try {
+            const msg = JSON.parse(text);
+            handleMessage(state, msg);
+        }
+        catch (e) {
+            logger.warn("[TunnelClient] 解析隧道消息失败:", String(e));
+        }
+    });
+    ws.on("close", (code, reason) => {
+        logger.warn("[TunnelClient] 隧道连接关闭: server=", state.serverUrl, "code=", code, "reason=", String(reason));
+        cleanup(state);
+        if (code === CLOSE_CODE_AUTH_FAILED) {
+            // 鉴权失败：继续重连只会每 5s 刷一次鉴权失败日志。
+            // 停止自动重连，等下次注册成功（autoRegisterSingle）显式重启隧道。
+            logger.warn("[TunnelClient] 鉴权失败（4001），停止自动重连；待重新注册后再启动隧道: server=", state.serverUrl);
+            return;
+        }
+        scheduleReconnect(state);
+    });
+    ws.on("error", (err) => {
+        logger.warn("[TunnelClient] 隧道连接错误: server=", state.serverUrl, "err=", err.message, "code=", err.code);
+        cleanup(state);
+        scheduleReconnect(state);
+    });
+}
+function cleanup(state) {
+    if (state.timer) {
+        clearInterval(state.timer);
+        state.timer = undefined;
+    }
+    // 关闭本地 WS 流
+    for (const [id, stream] of state.streams.entries()) {
+        try {
+            stream.ws.close(1011, "tunnel disconnected");
+        }
+        catch {
+            // ignore
+        }
+        state.streams.delete(id);
+    }
+    state.ws = undefined;
+}
+function scheduleReconnect(state) {
+    if (state.shuttingDown || state.reconnectTimer)
+        return;
+    state.reconnectTimer = setTimeout(() => {
+        state.reconnectTimer = undefined;
+        connect(state);
+    }, RECONNECT_DELAY_MS);
+}
+function handleMessage(state, msg) {
+    switch (msg.t) {
+        case "req":
+            handleHttpRequest(state, msg);
+            break;
+        case "wsopen":
+            handleWsOpen(state, msg);
+            break;
+        case "wsmsg":
+            handleWsMessage(state, msg);
+            break;
+        case "wsclose":
+            handleWsClose(state, msg);
+            break;
+        case "ping":
+            // server 端心跳探测，回复 pong 保持连接活跃
+            sendJson(state, { t: "pong" });
+            break;
+        case "pong":
+            break;
+        default:
+            logger.debug("[TunnelClient] 未知消息类型: t=", msg.t);
+    }
+}
+async function handleHttpRequest(state, msg) {
+    const id = msg.id;
+    const method = msg.method || "GET";
+    const path = msg.path || "/";
+    const localUrl = `http://127.0.0.1:${port}${path}`;
+    try {
+        const bodyBuffer = msg.body ? Buffer.from(msg.body, "base64") : undefined;
+        const headers = {};
+        if (msg.headers) {
+            for (const [key, values] of Object.entries(msg.headers)) {
+                if (values && values.length > 0) {
+                    headers[key] = values[0];
+                }
+            }
+        }
+        // ★ 注入隧道来源 server URL，供 /runtime/start 等处理器确定性识别回调目标 server，
+        //   避免多 autoRegisterTargets 时因 launch body 缺少 schedulerBaseUrl 而回退到
+        //   DEFAULT=localhost:8080 导致回调打错服务器（token 反查会因 server 端 rotate 失配）。
+        headers["x-bridge-tunnel-source"] = state.serverUrl;
+        const response = await axios.request({
+            url: localUrl,
+            method,
+            headers,
+            data: bodyBuffer,
+            timeout: 120_000,
+            responseType: "arraybuffer",
+            validateStatus: () => true,
+        });
+        const respHeaders = {};
+        for (const [key, val] of Object.entries(response.headers)) {
+            if (val === undefined)
+                continue;
+            respHeaders[key] = Array.isArray(val) ? val : [String(val)];
+        }
+        const bodyBase64 = Buffer.isBuffer(response.data)
+            ? response.data.toString("base64")
+            : "";
+        sendJson(state, {
+            t: "res",
+            id,
+            status: response.status,
+            headers: respHeaders,
+            body: bodyBase64 || null,
+        });
+    }
+    catch (err) {
+        const errorMsg = err instanceof AxiosError ? err.message : String(err);
+        logger.warn("[TunnelClient] 本地转发失败:", method, path, "->", errorMsg);
+        sendJson(state, {
+            t: "res",
+            id,
+            status: 502,
+            headers: { "content-type": ["text/plain; charset=utf-8"] },
+            body: Buffer.from(errorMsg).toString("base64"),
+        });
+    }
+}
+function handleWsOpen(state, msg) {
+    const id = msg.id;
+    const path = msg.path || "/";
+    const localWsUrl = `ws://127.0.0.1:${port}${path}`;
+    let localWs;
+    try {
+        localWs = new WebSocket(localWsUrl, { handshakeTimeout: 10_000 });
+    }
+    catch (e) {
+        logger.warn("[TunnelClient] 本地 WS 连接失败:", String(e));
+        sendJson(state, { t: "wsclose", id, code: 1011, reason: "local ws connect failed" });
+        return;
+    }
+    const stream = { ws: localWs, pending: [] };
+    state.streams.set(id, stream);
+    localWs.on("open", () => {
+        // 先 flush open 前排队消息（保持到达顺序），再通知 server 流已就绪
+        for (const item of stream.pending) {
+            sendToLocal(stream, item.data, item.bin);
+        }
+        stream.pending = [];
+        sendJson(state, { t: "wsopened", id });
+    });
+    localWs.on("message", (data, isBinary) => {
+        // ws 库通过第二参数 isBinary 区分文本/二进制帧；data 类型始终是 Buffer。
+        const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data);
+        sendJson(state, {
+            t: "wsmsg",
+            id,
+            bin: isBinary,
+            d: buffer.toString("base64"),
+        });
+    });
+    localWs.on("close", (code, reason) => {
+        state.streams.delete(id);
+        sendJson(state, { t: "wsclose", id, code, reason: String(reason) });
+    });
+    localWs.on("error", (err) => {
+        logger.warn("[TunnelClient] 本地 WS 错误: id=", id, "err=", err.message);
+        state.streams.delete(id);
+        try {
+            localWs.close(1011, err.message);
+        }
+        catch {
+            // ignore
+        }
+        sendJson(state, { t: "wsclose", id, code: 1011, reason: err.message });
+    });
+}
+function sendToLocal(stream, data, bin) {
+    if (bin) {
+        stream.ws.send(data);
+    }
+    else {
+        stream.ws.send(data.toString("utf-8"));
+    }
+}
+function handleWsMessage(state, msg) {
+    const stream = state.streams.get(msg.id);
+    if (!stream)
+        return;
+    const data = msg.d ? Buffer.from(msg.d, "base64") : Buffer.alloc(0);
+    if (stream.ws.readyState !== WebSocket.OPEN) {
+        // 本地 WS 尚未 open：排队等待，避免 PTY 打开瞬间的输入被丢弃
+        if (stream.pending.length >= MAX_PENDING_WS_MESSAGES) {
+            stream.pending.shift();
+            logger.warn("[TunnelClient] 本地 WS 未就绪，排队消息超上限，丢弃最旧一条: id=", msg.id);
+        }
+        stream.pending.push({ data, bin: Boolean(msg.bin) });
+        return;
+    }
+    sendToLocal(stream, data, Boolean(msg.bin));
+}
+function handleWsClose(state, msg) {
+    const stream = state.streams.get(msg.id);
+    if (!stream)
+        return;
+    state.streams.delete(msg.id);
+    try {
+        stream.ws.close(msg.code ?? 1000, msg.reason || "");
+    }
+    catch {
+        // ignore
+    }
+}
+function sendJson(state, payload) {
+    if (!state.ws || state.ws.readyState !== WebSocket.OPEN)
+        return;
+    try {
+        state.ws.send(JSON.stringify(payload));
+    }
+    catch (e) {
+        logger.warn("[TunnelClient] sendJson 失败:", String(e));
+    }
+}

package/dist/services/workspaceTaskChangeWatcher.js

@@ -376,7 +376,7 @@ async function flushChange(fullPath) {
 async function sendChangeRecord(ctx, record, cacheKey) {
     try {
         const callbackBaseUrl = resolveSchedulerBaseUrl().url;
-        const runtimeAccessToken = getRuntimeAccessToken(undefined, callbackBaseUrl) || getRuntimeAccessToken();
+        const runtimeAccessToken = getRuntimeAccessToken(callbackBaseUrl) || getRuntimeAccessToken();
         if (!runtimeAccessToken) {
             log.warn('Cannot send change record: no auth token');
             return;

package/dist/utils/file-utils.js

@@ -87,7 +87,7 @@ export async function downloadSkillZip(skillPackage, targetDir) {
         ? String(skillPackage.fileName).trim()
         : 'skill-package.zip';
     const outputPath = path.join(targetDir, fileName);
-    const runtimeAccessToken = getRuntimeAccessToken(undefined, schedulerBaseUrl) || getRuntimeAccessToken();
+    const runtimeAccessToken = getRuntimeAccessToken(schedulerBaseUrl) || getRuntimeAccessToken();
     if (!runtimeAccessToken) {
         throw new Error('runtime access token is required to download skill package');
     }

package/node_modules/zod/mini/index.cjs

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../v4/mini/index.cjs"), exports);

package/node_modules/zod/mini/index.d.cts

@@ -0,0 +1 @@
+export * from "../v4/mini/index.cjs";

package/node_modules/zod/mini/index.d.ts

@@ -0,0 +1 @@
+export * from "../v4/mini/index.js";

package/node_modules/zod/mini/index.js

@@ -0,0 +1 @@
+export * from "../v4/mini/index.js";